US 12,339,965 B2
Malware detection and content item recovery
Ishita Arora, San Francisco, CA (US); Anton Mityagin, San Francisco, CA (US); Ray Zhang, San Jose, CA (US); Sam Keller, Millbrae, CA (US); and Stacey Sern, Edison, NJ (US)
Assigned to Dropbox, Inc., San Francisco, CA (US)
Filed by Dropbox, Inc., San Francisco, CA (US)
Filed on Dec. 28, 2022, as Appl. No. 18/147,468.
Application 18/147,468 is a continuation of application No. 15/394,385, filed on Dec. 29, 2016, granted, now 11,580,221.
Prior Publication US 2023/0139473 A1, May 4, 2023
This patent is subject to a terminal disclaimer.
Int. Cl. G06F 21/56 (2013.01); G06F 8/71 (2018.01)
CPC G06F 21/566 (2013.01) [G06F 8/71 (2013.01); G06F 21/562 (2013.01); G06F 21/563 (2013.01); G06F 21/567 (2013.01); G06F 21/568 (2013.01); G06F 2221/034 (2013.01)] 14 Claims
OG exemplary drawing
 
1. A method comprising:
identifying, by a content management system, a change set including change entries describing changes made at a client device to content contained in content items;
analyze, by the content management system, the change set based on one or more malware detection rules;
determining, by the content management system, a number of the change entries in the change set that satisfy at least one of the one or more malware detection rules;
based on the number of the change entries that satisfy at least one of the one or more malware detection rules, initiating, by the content management system, a scan of other change sets associated with the client device to determine whether the client device has malicious software;
during the scan of the other change sets associated with the client device, confirming, by the content management system, that the client device has the malicious software;
identifying, by the content management system, a target content item affected by the malicious software;
identifying, by the content management system, a first change entry in the other change sets corresponding to a first indication of the malicious software affecting the target content item; and
restoring, by the content management system, the target content item to a prior version predating the first change entry.